China Blames Massive Internet Blackout On Hackers

Chinese officials Wednesday blamed a country-wide Internet outage on a hack attack. But security and networking experts suspect that the country's Internet infrastructure was compromised when Chinese government censors inadvertently blocked every website in the world.

What's Chinese for schadenfreude?

The official story from China didn't involve stifling freedom of expression. Instead, government officials blamed a domain name system (DNS) malfunction Tuesday for leaving the country's nearly 600 million Internet users without access to websites for 45 minutes. "We have tracked and analyzed the DNS and found that at least two of the 13 root name servers around the world were affected," said Dong Fang, an Internet engineer at Chinese security product vendor Qihoo 360, according to the Xinhua News Agency, which is the Chinese government's official press agency.

DNS converts website names into IP addresses. Thus, during the supposed DNS outage, anyone who typed in the IP address for a website -- provided it wasn't being blocked by Chinese censors operating the so-called Great Firewall of China -- should have still been able to reach their desired site.

Xinhua spun the apparent hack attack and resulting outage as a reason why China could no longer trust other countries to handle the DNS infrastructure. "All the root name servers are located in the United States, Japan, and European countries. A problem with them would affect all the domain name processes and website visits in China," Fang said. "Building root domain name servers in China should be completed as soon as possible."

But researchers at GreatFire.org, an anticensorship organization, disputed that version of events, saying in a blog post that the outage appeared to be caused by a government-initiated DNS poisoning attempt that went wrong. DNS poisoning refers to rerouting requests for certain websites to a different website, and is actively used by Chinese censors.

"We have conclusive evidence that this outage was caused by the Great Firewall," the researchers said. During the outage, notably, "we see that a lookup to 8.8.8.8, a public DNS operated by Google, returned bogus results if the lookup was done from China." Since that DNS wasn't one of the root name servers that was supposedly hacked, it should have resolved to the actual address.

Instead, even lookups to the Google-operated DNS resolved -- along with every other DNS attempt from inside China -- to 65.49.2.178, which is owned by Dynamic Internet Technology, which makes a censorship-circumvention tool called FreeGate. The site also contains a mirror of a news portal for practitioners of Falun Gong, which is banned in China.

"One hypothesis is that [the Great Firewall] might have intended to block the IP but accidentally used that IP to poison all domains," the GreatFire.org researchers said. According to the Pew Research Center, China has more Internet users than nearly all other countries -- baring India -- have people.

The result of the apparent DNS poisoning gone wrong was that the Dynamic Internet Technology site suffered the equivalent of a denial-of-service attack, as the site was flooded with access requests by every one of China's 591 million Internet users who attempted to access a website during the 45-minute Great Firewall meltdown.

When it comes to blocking websites, Chinese censors typically only restrict access to Chinese-language sites, or else individual articles on foreign news sites. But this week, the government's censors took the unusual step of blocking access to some foreign news sites in their entirety, including the International Consortium of Investigative Journalists in Washington, D.C., and Britain's Guardian -- as well as a handful of sites in France, Germany, and Spain -- after they published a report into offshore tax havens created by the wealthy relatives of some of China's top leaders, including the brother-in-law of Chinese president Xi Jinping. Some of those news sites posted Chinese-language versions of their stories.

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter.

Perimeter defense isn't rocket science, which may be the reason security pros often take it for granted. Without thoughtful and robust perimeter security measures, higher-level systems such as online security and application intelligence will be rendered almost worthless. This Dark Reading report, Building And Maintaining Effective Firewall Configurations report, recommends best practices for rooting out perimeter security issues and for configuring firewalls effectively in the first place. (Free registration required.)

All messages have been redirected back to DIT. That indicated that incidence was caused by the overthrowing-censorship tool by DIT. Perhaps, some freedom fighters were using DIT tools but failed to achieve its goal.

What's scary, is that the British Prime Minister, David Cameron, praises Chinese filter companies and wants to enact similar censorship here. It's already started with some ISPs, but they're so bad at it that they've been blocking sex education websites along with the pornography.

Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.

Published: 2017-05-09NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.